ddw-security-sastlisted

# Skill: /ddw-security-sast ## Description Static Application Security Testing (SAST). Scans the code for security vulnerabilities. **BLOCKING GATE** — the `sast` receipt is what lets a ticket leave CODE: to VERIFY in FEATURE and FIX, straight to CLOSEOUT in QUICK-FIX. No tier leaves it with open vulnerabilities. ## Inputs - The files modified during implementation. - `.ddw/rules/security.instructions.md` for the practices. - `.ddw/rules/validation-rules.instructions.md` §4 for the rules (F-SAST-01 to F-SAST-19, W-SAST-01) — the single source of truth for severity and disposition. - The project's stack: the "Stack" section of `AGENTS.md`. ## Execution Protocol 1. **Scan for hardcoded secrets** (F-SAST-01, always Critical): - Look for API key, password, token and connection string patterns. - Check that `.env` is in `.gitignore`. - Look for sensitive files that should not be in the repo. 2. **Scan for injection patterns:** - SQL/NoSQL: string concatenation in queries; user objects passed straight into queries (F-SAST-02, Critical). - Command injection: user input reaching exec/spawn/system (F-SAST-03, Critical). - Path traversal: user input in file paths (F-SAST-05, High). 3. **Scan for XSS** (F-SAST-06, High): - `innerHTML`, `dangerouslySetInnerHTML` with user input. - Missing sanitization on HTML output. 4. **Scan for unsafe functions and broken crypto:** - `eval()`, `exec()`, insecure deserialization (F-SAST-04 Critical / F-SAST-17 M